PT-2026-86999

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

PT-2026-88736

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A type confusion issue exists in the XML processing of the browser. This allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit ...

CVE-2026-11573: Uncontrolled Recursion

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

ALSA-2026:64812 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

CVE-2026-76958: Improper Restriction of XML External Entity Reference

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

NewStart CGSL MAIN 7.02 : expat Vulnerability (NS-SA-2026-0101)

The remote NewStart CGSL host, running version MAIN 7.02, has expat packages installed that are affected by a vulnerability: - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. CVE-2026-4518...

Fedora 43 : perl-XML-Bare (2026-14e358a2a2)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-14e358a2a2 advisory. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes...

Oracle Linux 10 : ELSA-2026-64810-0: / expat (ELSA-2026-648100)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648100 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers - expat:...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-3380)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to...

Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

RHEL 10 : expat (RHSA-2026:64810)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64810 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability

About Remote Code Execution - TeamCity CVE-2026-63077 vulnerability. TeamCity is a proprietary solution developed by JetBrains for automating software build, testing, and deployment processes. TeamCity uses a central server to coordinate builds and separate build agents to execute them. An agent...

CVE-2026-12853

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

LOYTEC L-IP BACnet/IP Routers Cross-site Scripting (CVE-2026-12496)

An unauthenticated remote attacker can inject and store malicious JavaScript in the OPC XML-DA server statistics page /webui/statistics/opcsrv of a LOYTEC L-IP BACnet/IP router by sending a crafted 'User-Agent' header in a POST request to the device's '/da' endpoint. The script executes in an...

TencentOS Server 4: perl-XML-Parser (TSSA-2026:0964)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0964 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...